» DealPly.exe
Overview
Analysis
File Details
Programs (1)

DealPly.exe

DealPly

DealPly Technologies Ltd.

The application DealPly.exe has been detected as a potentially unwanted program by 8 anti-malware scanners. This file is typically installed with the program DealPly by DealPly Technologies Ltd which is a potentially unwanted software program. It is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider.

File name:

DealPly.exe

Publisher:

DealPly Technologies Ltd.

Product:

DealPly

Description:

DealPly exe

Version:

1.1.149.20

MD5:

512de6b168d2621bb1015269bca7d3b5

SHA-1:

25f3191911d8f228a588008987da740b58d158d4

Scanner detections:

8 / 68

Status:

Potentially unwanted

Explanation:

May modify the web browser's settings including changing the homepage and search provider in addition to delivering ads (by injecting banner and text-links directly in the webpage).

Analysis date:

4/20/2024 12:05:39 AM UTC (today)

Scan engine

Detection

Engine version

Baidu Antivirus

Adware.Win32.CrossRider

4.0.3.1492

Bkav FE

W32.Clod267.Trojan

1.3.0.4959

ESET NOD32

Win32/Toolbar.CrossRider (variant)

8.9899

K7 AntiVirus

Trojan

13.1712319

Malwarebytes

PUP.Optional.DealPly.A

v2014.09.02.04

McAfee

Artemis!512DE6B168D2

5600.7019

Reason Heuristics

Threat.Win.Reputation.IMP

14.9.2.16

VIPRE Antivirus

Crossrider

29978

File size:

427 KB (437,248 bytes)

Product version:

1.1.149.20

Original file name:

DealPly.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\dealply\dealply.exe

File PE Metadata

Compilation timestamp:

3/20/2012 7:43:16 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:64k3ViprBlWaQBDrIrUgbVDgmb33cEfpjUb15R9xrdqt:64kWg0URXdC

Entry address:

0x41D23

Entry point:

E8, BA, 90, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, 85, C0, 74, 12, 83, E8, 08, 81, 38, DD, DD, 00, 00, 75, 07, 50, E8, 74, D0, FF, FF, 59, 5D, C3, 8B, FF, 55, 8B, EC, 83, EC, 10, A1, 40, 96, 46, 00, 33, C5, 89, 45, FC, 8B, 55, 18, 53, 33, DB, 56, 57, 3B, D3, 7E, 1F, 8B, 45, 14, 8B, CA, 49, 38, 18, 74, 08, 40, 3B, CB, 75, F6, 83, C9, FF, 8B, C2, 2B, C1, 48, 3B, C2, 7D, 01, 40, 89, 45, 18, 89, 5D, F8, 39, 5D, 24, 75, 0B, 8B, 45, 08, 8B, 00, 8B, 40, 04, 89, 45, 24, 8B, 35, 44, A0, 45, 00... 
[+]

Code size:

352.5 KB (360,960 bytes)

The file DealPly.exe has been discovered within the following program.

DealPly by DealPly Technologies Ltd

DealPly installs a web browser extension such as an Internet Explorer Browser Helper Object (BHO) to view web pages loaded and look for affiliated merchants in order to possibly provide better pricing or alternative deals on a given product or merchant.

www.dealply.com

72% remove it

Remove DealPly.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.